8

I'm maintaining an open-source library, which uses the MIT license. From contributions on GitHub and other discussions, I know of a few companies that use (or at least used) my library.

The MIT license includes

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

which means, that these companies in theory should already have made the information (of them using my library) public (when distributing their software). While in reality, of course, almost nobody does this, does it nonetheless mean, that I can just list these companies in a "trusted by" list in the README file of my repository (because I would not reveal anything that should not already be public)? Or do I need to get the permission of these companies to add them to such a list?


Edit: Thanks for all the answers! I've asked the companies (via email, mostly to info@...) for permission and will not list any of them if they do not give permission. My guess is, there will be no list. ;)

6
  • 9
    "Trusted by" sounds like too much of an endorsement and possibly a false claim. The fact seems to be, that you have heard from a second-hand source (e.g. GitHub discussions) that a particular company is using a particular MIT library. But that doesn't mean it's "trusted" by the company. You also don't necessarily know in which product they've incorporated the software. It could well be internal-only software in which they're using your MIT package, so the obligation to publish the MIT license statement would be internal only as well.
    – Brandin
    Apr 19 at 6:51
  • @Brandin that looks awfully like an answer. Could I trouble you write it as one, or just delete it in favour of Bart's answer?
    – MadHatter
    Apr 19 at 9:13
  • "While in reality, of course, almost nobody does this" ... that's a pretty strong claim. Why do you think that is the case?
    – xLeitix
    Apr 19 at 15:23
  • 1
    What is to be avoided is saying something untrue. It seems that what you actually know is that some employees of these companies use this code for something - which might be a side-project. If that is all, then it might not be worth mentioning.
    – Ben
    Apr 21 at 14:15
  • 1
    Thanks. From some, I also kind of know that it's not just for a personal side project. They used "we" instead of "I" and some described their use case, which sounded like the company project. But yeah, it's probably not worth it. I've decided to let go of the idea of listing any companies in my project. :) Apr 21 at 14:33

3 Answers 3

11

The requirement to include the copyright notice and MIT license statement means that at best customers of those companies should be able to know that your library is being used in the product, or maybe even only internal employees if the library is only used in-house. It does not mean that this knowledge is available to the general public.

Besides bringing the knowledge of who uses your library to a wider audience, what you are proposing can be read as an endorsement for your library by those companies.

Endorsements are not given lightly, so you definitely must ask for approval and be prepared that they might very well refuse or, if initially approved, later ask to be removed from the list.

4
  • 4
    Is this mostly about the usage of "trusted by" which indeed seem weird or misleading (with which I agree) or also about the need to keep the information who uses the code private. For the latter I don't see where such a obligation would be coming from. If the OP just uses "used by" they should be free to share the knowledge they obtained on who is using the code no?
    – Kvothe
    Apr 19 at 14:51
  • 2
    @Kvothe: There are trademark implications to using somebody else's brand name in support of your product, regardless of whether the statement is true. It must be worded in such a way that no reasonable consumer would construe it as an endorsement of the library. "Used by" is IMHO too ambiguous.
    – Kevin
    Apr 19 at 16:27
  • 3
    At least in the US trademark law is about distinguishing the source of goods, it does not give the holder of the mark some free-ranging right to control use of that mark in other contexts (though with a bevy of lawyers on call they can still make life unpleasant for the hapless). Apr 19 at 20:32
  • @Kevin "Used by" is direct and factual. Anything else - "chosen", "trusted", etc - isn't.
    – Therac
    Apr 21 at 15:19
3

There is nothing to indicate from just a discussion, or issue or code submission, that a particular company has distributed software using your library. (Or is even using your library, for that matter; it could be used only by a client of that company, or even just discussed for other reasons from a company account.) And even if they have distributed it, that doesn't mean they've distributed it publicly.

If you want to list users of your software without their permission, I would suggest you restrict yourself to those that have made clear, unambiguous public statements that they are using your software. So if a company is distributing their software to the public, and you can find in their distribution a notice that clearly indicates that software is using your library, you could list it with a pointer to the URL whence you found this information. I would not go beyond that without asking for permission.

1

Alternatively you can put this heading:

Used by

That way it's not in any way an explicit endorsement or claim of trust by those companies. But what it does give you is a way to list Google, Microsoft, Apple and other big companies (if they use your code and you can explicitly reference this, e.g., in their About section). You do not need permission to include this heading. If, say Microsoft's legal team requested their name off the list you could legally defend your display with the truth; and that removing their name would constitute fraud.

Note: IANAL so take this with commensurate salt grains

EDIT: As quoted on this 2017 forum thread - https://forums.contractoruk.com/business-contracts/125219-use-client-name-for-marketing-purposes-2.html

The use must accurately refer to the owner of the trademark or the goods or services sold under the trademark— it cannot be misleading or defamatory; The use must not imply any endorsement or sponsorship by the trademark owner; There should be no easier way to refer to the owner or its products; and Only so much of the trademark can be used as is needed to identify the trademark owner and no more—this is often taken to mean that only words may be used but not logos.

3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.